CVE-2026-74486: binfmt_misc: use exe_file_deny_write_access() for the interpreter clone

CVE-2026-74486: binfmt_misc: use exe_file_deny_write_access() for the interpreter clone

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

binfmt_misc: use exe_file_deny_write_access() for the interpreter clone

For MISC_FMT_OPEN_FILE entries load_misc_binary() clones the
registered interpreter file and denies write access to the clone via
plain deny_write_access(). The clone is installed as
bprm->interpreter and later released by the exec machinery through
exe_file_allow_write_access() which skips the i_writecount increment
for files with FMODE_FSNOTIFY_HSM set.

The deny and allow side can therefore come to different conclusions
when pre-content watches are in play: if a pre-content watch is added
to the interpreter after registration every subsequent exec through
that entry takes a write denial on the clone that is never paired
with a write allowance, driving the interpreter inode's i_writecount
further down with each exec and leaving the interpreter unwritable
even after the entry and all its users are gone.

Take the write denial via exe_file_deny_write_access() so both sides
of the pairing base their decision on the same file mode, and
propagate failure instead of silently ignoring it: an interpreter
that is concurrently open for writing now fails the exec with
ETXTBSY, exactly like an interpreter freshly opened via open_exec()
would.

The Linux kernel CVE team has assigned CVE-2026-74486 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.14 with commit 0357ef03c94ef835bd44a0658b8edb672a9dbf51 and fixed in 6.18.44 with commit 255a758697da87a205e072e0cfc35897b8f743b1
	Issue introduced in 6.14 with commit 0357ef03c94ef835bd44a0658b8edb672a9dbf51 and fixed in 7.1.8 with commit f0edbaf487e4653a680a7abb91c1df94cb7886aa
	Issue introduced in 6.14 with commit 0357ef03c94ef835bd44a0658b8edb672a9dbf51 and fixed in 7.2-rc6 with commit fa5990ca8fd917003e526036bcc50413edb9722c

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74486
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/binfmt_misc.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/255a758697da87a205e072e0cfc35897b8f743b1
	https://git.kernel.org/stable/c/f0edbaf487e4653a680a7abb91c1df94cb7886aa
	https://git.kernel.org/stable/c/fa5990ca8fd917003e526036bcc50413edb9722c